diff --git a/.gitignore b/.gitignore
index 92ead7f..c1765ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@
 /ikev2.fax.bz2
 /libreswan-3.15.tar.gz
 /libreswan-3.16.tar.gz
+/libreswan-3.17.tar.gz
diff --git a/libreswan.spec b/libreswan.spec
index 1f91590..a711779 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -1,5 +1,5 @@
 %global USE_FIPSCHECK true
-%global USE_LIBCAP_NG true
+%global USE_LIBCAP_NG 0
 %global USE_LABELED_IPSEC true
 %global USE_CRL_FETCHING true
 %global USE_DNSSEC true
@@ -17,8 +17,8 @@
 
 Name: libreswan
 Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
-Version: 3.16
-Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}.1
+Version: 3.17
+Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
 Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@@ -226,6 +226,10 @@ OBJ.linux.*/programs/pluto/cavp -v1psk ikev1_psk.fax | \
 %endif
 
 %changelog
+* Mon Apr 04 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
+- Updated to 3.17 for CVE-2016-3071
+- Disable LIBCAP_NG as it prevents unbound-control from working properly
+
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.16-1.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 
diff --git a/sources b/sources
index ef4b03f..790ce44 100644
--- a/sources
+++ b/sources
@@ -1,4 +1 @@
-22c2d8d5b637e20fe222ebcf99b4a917  libreswan-3.16.tar.gz
-d8b493de7179635a6ed2a4d0e1b35282  ikev1_dsa.fax.bz2
-c4fe7041300e6c21f4561ce818b5002f  ikev1_psk.fax.bz2
-7716c48a1a2b17ba25e89b79889d4004  ikev2.fax.bz2
+a37ce71229d491f30926788565f82e16  libreswan-3.17.tar.gz